Can you blacklist a host?

[hharvey]

Here's the situation I'm trying to muddle through:

We have a production server that inputs.conf is monitoring, all the files being monitored are in:

[monitor:///log_comp1/scribed/*/*/*.log]
index = production

Then we have a separate qa server that inputs that conf is also monitoring:

[monitor:///logs/scribed/*/*/*.log]
index = qa

The problem I am facing is that it turns out the production log server has a symlink on it for /logs/, which points to /log_comp1/

So, the qa monitoring statement is picking up logs from the production symlink and indexing it in the qa index - basically this stuff is being indexed twice, and it's causing confusion when searching in the qa index, since it throws production data back.

Is there a way to blacklist logs from the production server from being indexed by the qa monitoring statement? The directory names all all the same after /logs/scribed - so I can't use directory names in the blacklist, without accidentally blacklisting qa log data.

Any suggestions?

[_d_ · Accepted solution]

See if this setting in inputs.conf helps:

followSymlink = [true|false]

http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf

d.

[hharvey]

hey, whaddaya know, it worked! 😉 thank you for pointing out what I somehow missed while scouring that doc!